jaffacakes118_Trojan[.]Win32[.]Buzus[.]ogks[.]90b39f90bba7b66eaf17520c6e534f11

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Buzus.ogks.90b39f90bba7b66eaf17520c6e534f11
Size 256KB
Sample261018-1vkvmavzhy
SHA256 d4a3405c0ccded9fad7f5702e3534876b94b19912084c4b50b86f661cd745b7d
MD5 90b39f90bba7b66eaf17520c6e534f11
SHA1 037cff8e15cb4c862cf9a94122162705128844df
SHA512 8b371207a7f6ebedb9d865358e9d0dcf704590708c56d3abdc809070fa38750b57c6aa6623258b44fd9e388a5aef2ab94120fa608d0b1db393127544129bdc30
SSDEEP 3072:OIVulF05LZP2KFZRxHvA4ukbyEPzTf/UYQypP2a1F8EdCAQHGkssGBmPFLD5ytf2:CEV3jxHvA4tyE1Q9aocQmFQFX50pSX/
TLSH
T14E447C0176D5C832D5EB0339486BC7286779BC509B76C6CB6BC0BE8E6E316C28E35352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Buzus.ogks.90b39f90bba7b66eaf17520c6e534f11

File Explorer

jaffacakes118_Trojan.Win32.Buzus.ogks.90b39f90bba7b66eaf17520c6e534f11

.dll 256KB

jaffacakes118_Trojan.Win32.Buzus.ogks.90b39f90bba7b66eaf17520c6e534f11

IMPHASH b0db72702f239215d304a0f7c2f47341
SHA256 d4a3405c0ccded9fad7f5702e3534876b94b19912084c4b50b86f661cd745b7d
MD5 90b39f90bba7b66eaf17520c6e534f11
SHA1 037cff8e15cb4c862cf9a94122162705128844df
SHA512 8b371207a7f6ebedb9d865358e9d0dcf704590708c56d3abdc809070fa38750b57c6aa6623258b44fd9e388a5aef2ab94120fa608d0b1db393127544129bdc30
SSDEEP 3072:OIVulF05LZP2KFZRxHvA4ukbyEPzTf/UYQypP2a1F8EdCAQHGkssGBmPFLD5ytf2:CEV3jxHvA4tyE1Q9aocQmFQFX50pSX/
TLSH
T14E447C0176D5C832D5EB0339486BC7286779BC509B76C6CB6BC0BE8E6E316C28E35352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\LocalSvnForDailyBuild\dabingusa_new\src\Release\ToLoadAdapter.pdb

imagehlp

CheckSumMappedFile

psapi

GetModuleInformation

kernel32

ReadFile WriteFile SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree VirtualAlloc HeapAlloc HeapReAlloc GetCommandLineA GetProcessHeap RtlUnwind WriteConsoleW GetFileType RaiseException ExitProcess HeapSize Sleep GetACP IsValidCodePage HeapDestroy HeapCreate VirtualFree SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime LoadLibraryW LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP GlobalFindAtomA lstrcmpW GlobalFlags InterlockedIncrement GetThreadLocale GlobalGetAtomNameA SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection InterlockedDecrement GetModuleFileNameW GlobalAddAtomA GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryA lstrcmpA FreeLibrary GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree SetLastError LocalAlloc GetCurrentProcess IsBadReadPtr Thread32First GetCurrentThreadId OpenThread SuspendThread Thread32Next GetVersionExA OpenProcess WaitForSingleObject TerminateProcess LoadResource LockResource SizeofResource FindResourceA GetCurrentProcessId CreateToolhelp32Snapshot Module32First Module32Next VirtualProtect WritePrivateProfileStringA GetModuleFileNameA CreateFileA CreateFileMappingA MapViewOfFile UnmapViewOfFile CloseHandle GetFileSize GetTickCount ResumeThread GetModuleHandleA GetProcAddress GetVersion lstrlenA CompareStringA WideCharToMultiByte GetLastError MultiByteToWideChar InterlockedExchange GetStdHandle

user32

RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect DefWindowProcA CallWindowProcA SetWindowLongA SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetDlgCtrlID GetWindowRect SetWindowTextA ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA LoadCursorA GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextA UnregisterClassA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus ModifyMenuA EnableMenuItem CheckMenuItem SetCursor UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA ShowWindow GetCursorPos ValidateRect PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu SendMessageA GetParent GetWindowLongA GetLastActivePopup IsWindowEnabled EnableWindow GetWindowThreadProcessId PostMessageA MessageBoxA GetClassNameA PtInRect DestroyMenu

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible CreateBitmap GetDeviceCaps DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey AllocateAndInitializeSid OpenProcessToken GetTokenInformation InitializeAcl AddAccessDeniedAce AddAccessAllowedAce SetSecurityInfo FreeSid

shell32

SHFileOperationA

shlwapi

PathFindExtensionA PathFindFileNameA

oleaut32

VariantClear VariantChangeType VariantInit